Method and apparatus for operating and controlling a power system

ABSTRACT

A fuel cell power system has a plurality of fuel cell power modules, a plurality of local controllers, and a master controller. Each fuel cell power module includes a fuel cell for generating electrical power, and each local controller controls one respective fuel cell power module. The master controller controls the local controllers.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation application of U.S. application Ser.No. 10/604,395 filed Jul. 17, 2003, which is hereby incorporated byreference in its entirety.

BACKGROUND

This disclosure relates generally to the operation and control of apower system, and more particularly to a communication and controlarrangement in a modular power system for providing a reliable andautonomously controlled power system.

Discrete distributed power systems are used or contemplated for use innumerous applications, including primary or backup power for high valuecommercial equipment such as telecommunications infrastructure, primaryor backup power to commercial and residential buildings, and primary orbackup power to renewable energy sources for use in non-ground-basedsystems such as a High Altitude Airship (HAA), for example. A typicalprimary power system may include a power source such as a diesel orgasoline powered generator, a fuel storage tank, and a set of batteriesto store energy, for example. A typical renewable energy source mayinclude Photovoltaic (PV) arrays, for example. In applications involvingprimary or backup power for a HAA, it is desirable to combine arenewable energy source, such as PV arrays for example, with aregenerative energy source, such as a regenerative fuel cell systemutilizing electrochemical cells for example. However, in HAAapplications, there is a challenge to provide a system that is selfsustaining during long-term missions of up to one year or more. Whileexisting power systems are suitable for their intended purposes, therestill remains a need for improvements for HAA applications. Inparticular, a need exists for a power system with appropriate safeguardsthat will enable it to operate autonomously and reliably for extendedperiods of time.

SUMMARY OF THE INVENTION

An embodiment of the invention includes a fuel cell power system havinga plurality of fuel cell power modules, a plurality of localcontrollers, and a master controller. Each fuel cell power moduleincludes a fuel cell for generating electrical power, and each localcontroller controls one respective fuel cell power module. The mastercontroller controls the local controllers.

Another embodiment of the invention includes a method of controlling afuel cell power system having a plurality of fuel cell power modules.Each fuel cell power module is locally controlled using a respectivelocal controller, and the local controllers are globally controlledusing a master controller.

A further embodiment of the invention includes a fuel cell power systemhaving a plurality of fuel cell power modules, a plurality of localcontrollers, and a master controller. Each fuel cell power moduleincludes a fuel cell for generating electrical power and furtherincludes associated peripheral devices for supplying reactants to thefuel cell and for collecting current and reaction byproducts from thefuel cell. Each local controller controls one respective fuel cell powermodule based on a feedback control loop from sensors disposed in theassociated peripheral devices. The master controller controls the localcontrollers based on a master feedback control loop receiving feedbackfrom each local controller from which the master controller generatescontrol commands for each local controller.

BRIEF DESCRIPTION OF THE DRAWINGS

Referring now to the drawings wherein like elements are numbered and/orlabeled alike in several Figures:

FIG. 1 depicts a schematic representation of an exemplary power systemfor employing an embodiment of the invention;

FIG. 2 depicts a schematic representation of an exemplary regenerativeelectrochemical cell modular power system for use in the system of FIG.1;

FIG. 3 depicts a schematic representation of an exemplary anode feedelectrolysis cell for use in the system of FIG. 2;

FIG. 4 depicts a schematic representation of an exemplary communicationsystem for use in the system of FIG. 1;

FIG. 5 depicts an alternative communication system to the system of FIG.4;

FIG. 6 depicts an exemplary communications architecture for implementingan embodiment of the invention; and

FIG. 7 depicts an exemplary process for implementing an embodiment ofthe invention in the system of FIG. 1.

DETAILED DESCRIPTION

Embodiments of the invention provide a method and apparatus forproviding modular power in a flexible power system defined by variousoperating modules, wherein the modules are in operable communicationwith each other and are controlled by a processor receiving andanalyzing redundant system information, thereby providing a reliable andautonomously controlled power system.

FIG. 1 is an exemplary embodiment of a power system 10 having arenewable energy source, such as a Photo-Voltaic (PV) array for example,providing input power 20 to a PV Interface 30, a regenerativeelectrochemical cell Modular Power System (MPS) 100, employing ProtonExchange Membrane (PEM) processes for example, and an Output PowerConditioner (OPC) 40 that provides Power Out 50, which may be ac(alternating current) or dc (direct current) power. In an embodiment,MPS 100 includes an electrolyzer module (ELM) 200, a power module (PWM)300, a water storage module (WSM) 400, a hydrogen storage module (HSM)500, and a controller module (CTM) 600. CTM 600 is in operablecommunication with each power system module 200, 300, 400, 500 viacommunication bus 110 (represented by dashed lines) and localcontrollers (LCC) 210, 310, 410, 510. Power system modules 200, 300,400, 500 are in power and/or fluid communication with each other via aconduit network 120. The fluid communication in conduit network 120 mayallow for hydrogen flow in either direction thereby providing moreeffective utilization of space within the confines of the MPS enclosure130. In an embodiment, PWM 300 incorporates technology for creatingelectricity from hydrogen, such as a PEM fuel cell, or a generator(e.g., driven by an internal combustion engine, hydropower, wind power,solar power, or the like). As discussed herein, where PWM 300 isconfigured as a fuel cell, it may also be referred to as a fuel cellmodule (FCM) 300. CTM 600 is also in operable communication with PVinterface 30 and OPC 40 via communication bus 110. A more detailedschematic of MPS 100 is depicted in FIG. 2, which shows ELM 200 havingan electrolyzer 700 and phase separator 215, and FCM 300 having anelectrochemical fuel cell system 800. Other details relating to MPS 100and depicted in FIG. 2 will be discussed further below.

Referring now to FIGS. 2-3, electrochemical energy conversion cellsemployed in embodiments of ELM 200 and FCM 300 will be discussed.Although embodiments disclosed below are described in relation to anelectrochemical power system including a proton exchange membraneelectrochemical cell employing hydrogen, oxygen, and water, other typesof electrochemical cells and/or electrolytes may be used, including, butnot limited to, phosphoric acid and the like. Various reactants can alsobe used, including, but not limited to, hydrogen, bromine, oxygen, air,chlorine, and iodine. Upon the application of different reactants and/ordifferent electrolytes, the flows and reactions change accordingly, asis commonly understood in relation to that particular type ofelectrochemical cell. Electrochemical cells may be configured aselectrolysis cells or fuel cells, as will be discussed below.

Referring now to FIG. 3, an electrochemical cell configured as an anodefed electrolysis cell 702, which may be formed in a stack of one or moreto form electrolyzer 700 and employed in an embodiment of ELM 200, isdepicted in section view having a proton exchange membrane (PEM) 705arranged between an oxygen electrode (anode) 710 and a hydrogenelectrode (cathode) 715. Electrolysis cell 702 functions as a hydrogengenerator by electrolytically decomposing process water 720 to producehydrogen gas 725 and oxygen gas 730. Process water 720 is fed intoelectrolysis cell 702 at anode 710 to form oxygen gas 730, electrons,and hydrogen ions (protons) 735. The chemical reaction is facilitated bythe positive terminal of a power source 740 connected to anode 710 andthe negative terminal of power source 740 connected to cathode 715.Power source 740 may be internal or external to ELM 200 and may includea battery or a connection to utility power or a renewable energy source.In an exemplary embodiment, power source 740 is fed by PV interface 30.Oxygen gas 730 and a first portion 745 of the water are discharged fromelectrolysis cell 702, while protons 735 and a second portion 750 of thewater migrate across PEM 705 to cathode 715. At cathode 715, hydrogengas 725 is removed, generally through a gas delivery line at conduitnetwork 120. The removed hydrogen gas 725 is usable in a myriad ofdifferent applications. Second portion 750 of water is also removed fromcathode 715.

ELM 200 may include a number of individual electrolysis cells 702arranged in a stack with process water 720 being directed through thecells via input and output conduits formed within the stack structure.Electrolysis cells 702 within the stack are sequentially arranged, witheach cell 702 having a membrane-electrode assembly (MEA) defined by aproton exchange membrane 705 disposed between a cathode 715 and an anode710. The cathode 715, anode 710, or both may be gas diffusion electrodesthat facilitate gas diffusion to the proton exchange membrane 705. Eachmembrane-electrode assembly is in fluid communication with flow fieldsadjacent to the membrane electrode assembly and defined by structuresconfigured to facilitate fluid movement and membrane hydration withineach individual electrolysis cell 702.

The water 750 discharged from the cathode side 715 of the electrolysiscell 702, which is entrained with hydrogen gas, may be fed to a phaseseparator 215 (see FIG. 2) to separate the hydrogen gas 725 from thewater 750, thereby increasing the hydrogen gas yield and the overallefficiency of electrolysis cell 702 in general. The removed hydrogen gas725 may be fed either to a dryer 220 (see FIG. 2) for removal of tracewater, to HSM 500, which may be a cylinder, a tank, or a similar type ofcontainment vessel, or directly to an application for use as a fuel,such as to FCM 300 (see FIGS. 1 and 2).

Another type of water electrolysis cell (not shown) that utilizes thesame configuration as is shown in FIG. 3 is a cathode feed cell. In thecathode feed cell, process water is fed on the side of the hydrogenelectrode. A portion of the water migrates from the cathode across themembrane to the anode. A power source connected across the anode and thecathode facilitates a chemical reaction that generates hydrogen ions andoxygen gas. Excess process water exits the electrolysis cell at thecathode side without passing through the membrane.

A typical fuel cell system 800 (depicted in FIG. 2) also utilizes thesame general MEA configuration as the electrochemical cell of FIG. 3,depicted therein as an electrolysis cell. In the fuel cell system 800configuration, hydrogen gas 725 is introduced to hydrogen electrode 715(the anode in the fuel cell system 800), while oxygen 730, or anoxygen-containing gas such as air, is introduced to oxygen electrode 710(the cathode in the fuel cell system 800). The hydrogen gas for fuelcell operation can originate from a pure hydrogen source, a hydrocarbon,methanol, an electrolysis cell 702 such as that described above withreference to FIG. 3, or any other source that supplies hydrogen at apurity level suitable for fuel cell operation. The hydrogen gas 725electrochemically reacts at the anode 715 to produce protons 735 andelectrons, the electrons flow from the anode through an electricallyconnected external load, and the protons 735 migrate through the protonexchange membrane 705 to the cathode 710. At the cathode 710, theprotons and electrons react with oxygen 730 to form product water 720.

The general operation of MPS 100 involves the delivery of water from WSM400 to ELM 200, where the water is electrolyzed to form hydrogen andoxygen gas. The hydrogen gas is dispensed from ELM 200 to HSM 500, fromwhich it is periodically retrieved and dispensed to FCM 300. Oncereceived in FCM 300, the hydrogen gas is reacted with oxygen, fromeither an air supply 60 or from oxygen production at ELM 200, to produceelectrons and water. In HAA applications, oxygen production at ELM 200may be stored at oxygen storage device 70 for subsequent use at FCM 300.Power is distributed from MPS 100 by directing the electrons to outputpower conditioner 40 for subsequent delivery, depicted generally aspower out 50, to an attached load (not shown). Excess water is returnedto WSM 400. The operation and control of MPS 100 and the distribution ofpower is governed by CTM 600, LCCs 210, 310, 410, 510 and embeddedapplication software, as will be discussed in more detail below.

Referring now to FIG. 4, an embodiment of MPS 100 includes a pluralityof ELMs 200, a plurality of PWMs 300, and a HSM 500, all in signalcommunication with each other via communication bus 110 and internalbuses 295, 395, 595, respectively. In an embodiment, communications bus110, LCCs 210, 310, 510 and internal buses 295, 395, 595 may operateunder a Controller Area Network (CAN) bus and associated communicationsprotocol, where a broadcast communication is achieved by using a messageoriented transmission protocol. Here, messages communicated betweenmodules are identified by using a message identifier, which is uniquewithin the network and not only defines the content but also thepriority of the message. By utilizing a CAN scheme, MPS 100 can beupgraded by installing newer modules or additional modules withouthaving to make any hardware or software modifications to the existingmodules. Other communication schemes may be equally applicable forimplementing the disclosed invention and may be substituted for the CANprotocol communication scheme.

In alternative embodiments, CTM 600 may be present and configured as amaster control module to serve as a centralized controller with LCCs210, 310, 410, 510 operating as local controller sub-systems, or may notbe present as a separate module, but may have some or all of itsfunctionality embedded within LCCs 210, 310, 410, 510, thereby providingfor a distributed control scheme, or may be present with limitedfunctionality to serve as a signal interface, such as provided by signalinterface 605, to send and receive external signals 607 and communicatethose signals with MPS 100. External signals 607 may be wired orwireless, and may employ radio frequency signals, microwave signals,optical signals, or any other type of communication signal appropriatefor the environment in which power system 10 is employed, such as in aHAA for example. Alternatively, CTM 600 and signal interface 605 mayboth be present in MPS 100 to provide coordinated signal processing. Inan alternative embodiment, HSM 500 may be replaced with an integratewater and hydrogen storage module (WHSM), depicted generally at 900, inwhich case LCC 410 and LCC 510 may be integrated into one localcontroller, herein referred to as LCC 510. In a further alternativeembodiment, electrolyzer 700, and accompanying necessary hardware, maybe mounted or integrated into the assembly of HSM 500, thereby providinga more compact hydrogen generator and storage module.

In an embodiment, modules 200 and 300 include a communications port 945,depicted generally in FIG. 4 as the connection point betweencommunications bus 110 and modules 200, 300, which is in signalcommunication with an associated local controller, 210 or 310 forexample. In a centralized control scheme, data and control signals fromCTM 600 are communicated to the appropriate local controller of a modulevia communication bus 110 and communication port 945. In a distributedcommunication scheme, data and control signals from one local controllerare communicated to another local controller via communication bus 100and communication port 945.

As depicted in FIG. 4, ELM 200 and PWM 300 may include powerconditioning units 290, 390, respectively. Power conditioning unit 290receives power from PV interface 30 and delivers conditioned power toelectrolyzer 700 at power source 740, and power conditioning unit 390provides power out 50 from fuel cell 800 via output power conditioner40. In alternative embodiments, power conditioning unit 390 may beseparate from or integrated with output power conditioner 40.

Referring now to FIG. 5, an alternative arrangement of ELMs 200 and PWMs300 is depicted within power system 10. Whereas in FIG. 4 each ELM 200and PWM 300 is depicted grouped with a like module, FIG. 5 depicts eachELM 200 and PWM 300 grouped in a module set 1000 along with other systemmodules, discussed further below, and with communication bus 110providing a common data bus between all modules. As depicted by ellipses1010, other module sets 1000 may be attached to communications bus 110,and to conduit network 120 (shown in FIGS. 1, 2 and 4 and omitted fromFIG. 5 for clarity). FIG. 5 depicts each module set 1000 having a localcontroller 610, and ELM 200, a WHSM 900, a bridge 80, a PWM 300, and apower conditioner 90. Local controller 610 is similar to LCCs 210, 310,410, 510, but serves to control the entire set of modules within moduleset 1000 as opposed to controlling only one type of module. Each systemmodule within module set 1000 is referred to simply as a system module,or power system module, and includes any one of the aforementionedmodules 610, 200, 900, 80, 300 and 90.

Similar to the discussion above, CTM 600 may be present and configuredas a master control module to serve as a centralized controller withlocal controllers 610 of each module set 1000 operating as a localcontroller sub-system, or may not be present as a separate module butmay have some or all of its functionality embedded within each localcontroller 610, thereby providing for a distributed control scheme. Ineither arrangement, CTM 600 and local controllers 610 may operate undera Controller Area Network (CAN) bus with associated communicationsprotocol, as discussed above. CTM 600, LCCs 210, 310, 410, 510, andlocal controller 610 include a processor 620 and a memory 630, depictedin FIG. 5, for storing and executing control instructions provided byembedded software, and for storing operational information such asoperating characteristics in lookup tables for example. Processor 620may be a microprocessor or any other processing device sufficient tocontrol power system 10. Bridge 80 provides a similar function as powerconditioning unit 290 discussed above, but instead of servingconditioned power to just electrolyzer 700 it serves conditioned powerto all modules within module set 1000, thereby reducing the number ofcomponents within and the overall size and weight of power system 10.Power conditioner 90 provides a similar function as power conditioningunit 390 and may also be separate from or integrated with output powerconditioner 40.

As mentioned above, the output power, depicted generally as power out50, may be ac (alternating current) or dc (direct current) power. Inalternative embodiments, the output power is provided at about 24 VDC(volts direct current) or about 48 VDC, depending on the market needs,and the input power at PV input 20 and PV interface 30 is provided atabout 120/240 VAC (volts alternating current), single-phase, at about50/60 Hz (Hertz). However, MPS 100 may be designed to operate over awider range of input voltages, such as from about 85 to about 264 VACinput, for example. An embodiment of MPS 100 has an output current ofabout 42 amps, with a minimum of about 0 amps and a maximum of about 45amps, at an output voltage of about 24 VDC+/−0.5 VDC. In an embodiment,MPS 100 has an output voltage that deviates no more than about +/−0.5VDC in response to an ambient temperature variation from about −40 deg-C(degrees Celsius) to about +50 deg-C, and can operate at an altitudeequal to or less than about 80,000 feet.

In an embodiment and referring to FIG. 5, the operational control ofpower system 10 by CTM 600, LCCs 210, 310, 410, 510, and/or localcontrollers 610, is assisted by strategically placed sensors 1020, 1030throughout power system 10, with sensors 1020 referring generally tosensors placed within an operational module to sense the operatingcharacteristics of that particular module, and sensors 1030 referringgenerally to sensors placed to sense the operating characteristics ofpower system 10 as a whole. Sensors 1020, 1030 may be different types ofsensors and include but are not limited to temperature sensors, depictedas a boxed-T 1040, pressure sensors, depicted as a boxed-P 1042, andvoltage sensors, depicted as a boxed-V 1044. As herein used, thenomenclature for identifying a module temperature sensor is 1020, 1040,and the nomenclature for identifying a system temperature sensor is1030, 1040. Other sensors, such as flow meters and ammeters for example,may be employed as appropriate for carrying out the control functionherein disclosed.

Also provided within power system 10 are control devices 1050, 1060 forcontrolling the flow of power, fluid, gas, coolant, and heat, forexample, within and between modules of power system 10, with controldevices 1050 referring generally to devices placed within an operationalmodule to control an operating characteristic of that particular module,and control devices 1060 referring generally to devices placed tocontrol an operating characteristic of power system 10 as a whole.Exemplary control devices 1050, 1060 include but are not limited topumps, depicted as a circled-P 1070, valves, depicted as a circled-V1072, and electrical switches, depicted as a circled-S 1074. As hereinused, the nomenclature for identifying a module pump control device is1050, 1070, and the nomenclature for identifying a system pump controldevice is 1060, 1070. Other control devices, such as fans, compressorsand variacs for example, may be employed as appropriate for carrying outthe control function herein disclosed.

The plurality of sensors 1020, 1030 provide a plurality of sensorsignals from either the system modules of module set 1000, or powersystem 10 as a whole, with the respective signals being received atcommon data bus 110. While reference is made herein to FIG. 5 regardingthe signal flow and control scheme of power system 10, it will beappreciated that a similar arrangement applies to the modularconfiguration depicted in FIG. 4 and to any other modular configurationof system modules that may be employed in practicing the teachings ofthe present invention.

The sensor signals are received from common data bus 110 at localcontroller 610 and/or CTM 600, depending on whether a centralized ordistributed control scheme is implemented as discussed above, andanalyzed for the presence of an abnormal operating condition or for thepresence of a malfunctioning device, where the malfunctioning device mayinclude, for example, a sensor 1020, 1030, a processing element 200,300, an output device 90, 40, a control device 1050, 1060, or anycombination thereof.

Upon receipt of sensor or device information, by continuous polling byCTM 600 and/or local controller 610, or by continuously monitoring thesignal traffic on common data bus 110, for example, processor 620accesses operational information in a lookup table in memory 630 todetermine whether that particular sensor or device is providing a normaloperational reading. The lookup table in memory 630 may be an actualtable of values upon which processor 620 performs aninterpolation/extrapolation technique, or may be a transfer functionupon which processor 620 performs a calculation. In response toprocessor 620 determining that an abnormal operating condition exists,processor 620 then determines whether an operational adjustment isdesirable at one of the control devices at the system module level or atthe power system level. An adjustment may be made to either compensatefor the abnormal condition, or to accommodate for the malfunctioningdevice, discussed further below. It should be noted that not allabnormal operating conditions reported by a sensor may warrant anoperational adjustment. For example, if a sensor is unhealthy, discussedfurther below, or if a sensor reading is just outside of an acceptablerange, then processor 620, via the embedded application software, mayseek information from other sources to determined whether an operationaladjustment should be made. Also, if a sensor is healthy, but reports anabnormal condition, processor 620 may use statistical tools such astrending or control sampling to determine whether an operationaladjustment should be made. An abnormal condition may be the result of ananomaly, a data point that is an outlier, or the result of signal noise,in which case the utilization of statistical techniques by processor 620may avoid unwarranted system adjustments. Other decisions regarding thedesirability of an operational adjustment may come from processor 620accessing a lookup table at memory 630 to determine whether the sensorsare sensing operating characteristics, and thereby reporting onoperating conditions, that are within an expected range for the existingpower condition and fuel consumption of power system 10. In conjunctionwith the lookup table at memory 630, processor 620 may employinterpolation or extrapolation techniques, or other algorithms, forcomparing sensed operating characteristics to expected operatingcharacteristics at a given system power level. In response to processor620 determining that an operational adjustment is desirable, processor620 automatically adjusts a control device 1050, 1060, by changing theoperating state of at least one of a pump 1070, a valve 1072, a switch1074, or any combination thereof, for example, in a direction tocompensate for the abnormal condition, or to accommodate for themalfunctioning device. For example, if the temperature or pressure at anelectrolyzer 700 at an ELM 200 is above normal, then processor 620 mayreduce the flow of processing water and the available power by adjustinga pump 1070 or a valve 1072 and operating a switch 1074 at the effectedELM 200. Also, if a system module pump 1050, 1070 malfunctions andcontinued operation of that module would risk the integrity of themodule and possibly the integrity of the power system 10 as a whole,then processor 620 may shut down the operation of that particular moduleto prevent an entire system shutdown, which in essence results in anautomatic reconfiguring of the controlled operational devices and thecontrol system as a whole. In an embodiment, processor 620 may run powersystem 10 at reduced performance to accommodate the malfunctioningdevice or loss of data therefrom.

In an alternative embodiment employing MPS 100 as depicted in FIG. 4with a plurality of fuel cell power modules 390, a failure of one modulemay be detected by the remaining modules via common communication bus110, whereby the remaining modules make compensating adjustments usinglogic contained in local controllers 310.

In another alternative embodiment employing MPS 100 as depicted in FIG.5 having a plurality of Electrolyzer Modules 200, a temperature sensorfailure in one module may be compensated for by temperature readings ata similar temperature sensor in another module based on algorithmicassumptions about present operating modes of both modules and predefinedphysical and mathematical relationships between similar units that maybe running at slightly differing operating conditions or modes.

In a further alternative embodiment employing MPS 100 as depicted inFIG. 5, the loss of an ambient temperature sensor in Power Module 300may be synthesized using the temperature reading at WHSM 900. Thesynthesis may include mathematical formulas and interpolation tablesthat represent the physical relationship between these temperaturesunder idealized theoretical data and/or previously measured data.

To ensure high reliability for autonomous control of power system 10,redundant sensors and multiple channel communication may be employed,thereby enabling an operating characteristic monitored by a particularsensor to be derivable from one or more other sensors in the system. Inthis manner, redundant system information is available from a pluralityof sources and over a plurality of channels for determining whether anoperational adjustment of MPS 100 or a portion thereof is desirable. Insome cases, it may be necessary to shut down MPS 100 or a portionthereof, and in other cases it may just be necessary to store the datarelating to the operating characteristics of MPS 100 at memory 630 andto report the stored data to an external system or user on demand viasignal interface 605. Processor 620 and embedded application softwareare configured for multi-channel communication. In an embodiment,processor 620 may utilize a portion of the stored data using programmedadaptive logic to synthesize a replacement signal or to command adegraded operational mode.

Although a common bus 110 is shown for illustration, power system 10 maybe configured using the invention described herein by employing aredundant common bus communications scheme, best seen by now referringto the communications architecture 1200 depicted in FIG. 6. In referenceto FIG. 6, elements of power system 10 are depicted generally asElements A, B, C, D and E, and identified by numerals 1210, 1211, 1212,1213 and 1214 (1210-1214), respectively, which may refer to any of theaforementioned modules, and interconnecting lines between Elements A, B,C, D and E represent lines of communication. Redundant channels 1205 arerepresented by double lines, as depicted between Elements A and C, andbetween Elements D and E, and non-redundant channels (simplex channels)1215 are represented by single lines. In an embodiment, communicationbus 110 may be configured as two or more segmented buses over which datamay be transferred between system Elements 1210-1214 in a parallelfashion to facilitate redundancy management. The two or more segmentedbuses may be composed of redundant channels 1205, simplex channels 1215,or any combination thereof. For example, communication between Element A1210 and Element E 1214 may occur directly via simplex channel 1215, orindirectly via segmented buses composed of simplex channel 1215 toElement B 1211, simplex channel 1215 to Element D 1213, and redundantcommon bus 1205 to Element E 1214. Other communication paths will bereadily recognized by one skilled in the art. In the preceding example,the utility of a redundant common bus communication scheme is achievedwithout actually requiring a single bus that is common to all elements,with inter-bus communications being accomplished via a microprocessor orother data translation hardware, firmware and/or software combination.As depicted in FIG. 6, the implementation of the redundant common buscommunication scheme may be a combination of simplex and redundantchannels arranged in a network between elements to facilitate a packetswitching arrangement and ensure message delivery under single ormultiple bus failures. In an embodiment, the communication architecturedepicted in FIG. 6 may be implemented using a TCP/IP protocol over anEthernet network.

Referring now to FIG. 7, an exemplary process 1100 for determiningwhether an operational adjustment should be carried out by processor 620is depicted. Process 1100 is depicted as a continuous loop process,indicating a control scheme that continuously monitors signal traffic oncommon data bus 110. At block 1105, processor 620 determines whethereach sensor 1020, 1030 is reporting a normal operating condition. Ifyes, then control passes to block 1110 where power system 10 continuesoperation, and process 1100 continues by reentering decision block 1105.If no, then control passes to block 1115 where processor 620 determineswhether the reporting sensor is an unhealthy sensor. In an embodiment, asensor may be considered to be unhealthy if it is not reporting anysignal when it should or if its signal is representative of anunattainable value. In another embodiment, two sensors may be employedalong with a voting scheme, whereby a high sensor reading in the firstsensor may take precedence over a low sensor reading in the secondsensor, thereby resulting in the second sensor being consideredunhealthy. Other unhealthy sensor characteristics may be stored inmemory 630 and used by processor 620 for comparative analysis. Thenumber of sensors deployed to monitor a particular aspect of the powersystem operation, such as pressure or temperature for example, isdetermined by the importance of that parameter with regard to theoverall system operation. Also, the scheme to determine the health ofany one sensor, such as averaging multiple sensors, selecting theclosest two out of three, or using the highest or lowest reading, forexample, is dependent on the importance of the parameter being sensed tothe overall system operation.

If the sensor is considered to be unhealthy, process control passes toblock 1120 where it is determined whether the sensed characteristic ofthe unhealthy sensor is derivable from one or more other sensors inpower system 10. For example, in the two sensor scenario discussedabove, the first sensor reading would take precedence over the second.In another example, a sensor reading at a system module sensor 1020 maybe derivable via a set of system transfer functions involving bothsystem module sensors 1020 and power system sensors 1030, whichcollectively provide redundant information in the event that any onesensor becomes unhealthy.

In response to the sensed characteristic of the unhealthy sensor beingderivable, process control passes to block 1125 where processor 620determines whether the other sensors in the system are reporting anormal operating condition. In determining that a normal operatingcondition is present, process control passes to block 1110 and continuesas discussed above.

In response to the sensed characteristic of the unhealthy sensor notbeing derivable, or in response to the derived characteristic by othersensors in the system being indicative of an abnormal operatingcondition, process control passes to block 1130 where it is determinedwhether an operational adjustment of a system module within module set1000 is desirable, as discussed above. If it is considered desirable tomake no system module adjustment, process control passes to block 1135where power system 10 continues operation and process 1100 continues byreentering decision block 1105.

If it is considered desirable to make an operational adjustment to asystem module, process control passes to block 1140 where processor 620automatically adjusts a control device 1050, 1060 in a direction tocompensate for the abnormality, as discussed above. Following block1140, process control passes to block 1145 where processor 620determines whether it is desirable to shutdown the operation of MPS 100or a portion thereof, such as when the integrity of the system is atrisk for example. If no, then process control passes to block 1135 andprocess 1100 continues as discussed above. If yes, then process controlpasses to block 1150 where processor 620 shuts down MPS 100 or a portionthereof.

Some embodiments of the invention may include some of the followingadvantages: autonomous control; no or very low maintenance; built insafeguards; system segmentation through modularity of design;centralized or distributed control arrangements; data recording andreporting on demand; and scaleable system through modularity of design.

While the invention has been described with reference to exemplaryembodiments, it will be understood by those skilled in the art thatvarious changes may be made and equivalents may be substituted forelements thereof without departing from the scope of the invention. Inaddition, many modifications may be made to adapt a particular situationor material to the teachings of the invention without departing from theessential scope thereof. Therefore, it is intended that the inventionnot be limited to the particular embodiment disclosed as the best oronly mode contemplated for carrying out this invention, but that theinvention will include all embodiments falling within the scope of theappended claims. Moreover, the use of the terms first, second, etc. donot denote any order or importance, but rather the terms first, second,etc. are used to distinguish one element from another. Furthermore, theuse of the terms a, an, etc. do not denote a limitation of quantity, butrather denote the presence of at least one of the referenced item.

1. A fuel cell power system comprising: a plurality of fuel cell powermodules, each fuel cell power module including a fuel cell forgenerating electrical power; a plurality of local controllers, eachlocal controller controlling one respective fuel cell power module; anda master controller for controlling the local controllers.
 2. The fuelcell power system as claimed in claim 1 wherein the fuel cell powermodules are electrically connected in parallel.
 3. The fuel cell powersystem as claimed in claim 2 wherein the fuel cell power modules aresubstantially identical.
 4. The fuel cell power system as claimed inclaim 1 wherein the master controller comprises a plurality of datacommunications ports connected to data communication links linking themaster controller with respective data communication ports on the localcontrollers.
 5. The fuel cell power system as claimed in claim 4 whereinthe master controller comprises an additional data communications portfor receiving a power requirement signal from an overall systemcontroller.
 6. The fuel cell power system as claimed in claim 5 whereinthe master controller and local controllers are linked using a CANbuscontroller area network.
 7. A method of controlling a fuel cell powersystem having a plurality of fuel cell power modules, the methodcomprising the steps of: locally controlling each fuel cell power moduleusing a respective local controller; and globally controlling the localcontrollers using a master controller.
 8. The method as claimed in claim7 further comprising the step of selectively bypassing at least one ofthe fuel cell power modules.
 9. The method as claimed in claim 8 whereinthe step of bypassing at least one of the fuel cell power modulescomprises the step of receiving a fault signal at the master controllernecessitating shut-down of a faulty fuel cell power module.
 10. Themethod as claimed in claim 7 further comprising the steps of: receivingsystem performance data at the master controller from sensors located ateach of the fuel cell power modules; processing the system performancedata at the master controller to provide feedback control of the localcontrollers; relaying selected system performance data to an overallsystem controller.
 11. The method as claimed in claim 10 wherein thestep of relaying selected system performance data to an overall systemcontroller comprises the step of presenting the system performance datato a user.
 12. A fuel cell power system comprising: a plurality of fuelcell power modules, each fuel cell power module including a fuel cellfor generating electrical power and further including associatedperipheral devices for supplying reactants to the fuel cell and forcollecting current and reaction byproducts from the fuel cell; aplurality of local controllers, each local controller controlling onerespective fuel cell power module based on a feedback control loop fromsensors disposed in the associated peripheral devices; and a mastercontroller for controlling the local controllers based on a masterfeedback control loop receiving feedback from each local controller fromwhich the master controller generates control commands for each localcontroller.